Remarks 



This Preliminary Amendment cancels, without prejudice, claims 1-8 in the 
underlying PCT Application No. PCT/DE2004/000444 and adds new claims 9-16. 
The new claims, inter alia , conform the claims to United States Patent and 
Trademark Office rules and do not add any new matter to the application. 

In accordance with 37 C.F.R. § 1.125(b), the Substitute Specification 
(including Abstract) contains no new matter. The amendments reflected in the 
Substitute Specification (including Abstract) are to conform the Specification and 
Abstract to United States Patent and Trademark Office rules or to correct 
informalities. As required by 37 C.F.R. §§ 1.121(b)(3)(ii) and 1.125(c), a Marked- 
Up Version of the Substitute Specification comparing the Specification of record 
and the Substitute Specification also accompanies this Preliminary Amendment. 
Approval and entry of the Substitute Specification (including Abstract) are 
respectfully requested. 

The underlying PCT Application No. PCT/DE2004/000444 includes an 
International Search Report, dated July 20, 2004, a copy of which is included. The 
Search Report includes a list of documents that were considered by the Examiner 
in the underlying PCT application. 

Applicants assert that the subject matter of the present application is new, 
non-obvious, and useful. Prompt consideration and allowance of the application 
are respectfully requested. 



Respectfully Submitted, 



KENYON & KENYON 




One Broadway 

New York, NY 10004 

(212)425-7200 
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CONTROL UNIT FOR A RESTRAINT SYSTEM 
Background Of Th e Inv e nt i on lnformation 

The i nvention proceeds from a control unit for a restraint system accord i ng to the 
spec i es def i ned in the independent cla i m. 

In certain markets such as Japan, a so-called disposal firing function is required by 
5 law in control units for restraint systems. Its purpose is safely to fire or burn off all the 
pyrotechnic firing and gas generation elements of airbags and belt tensioners when 
the vehicle is scrapped. The scrapping operation can then proceed without danger 
from the airbags, and without endangering the environment. In addition, the burned- 
off pyrotechnic elements do not require laborious disposal, but can be recycled as 
10 scrap metal. 



The control unit according to the present invention hav i ng the features of the 
independent c l aim has, in contrast thoroto f has the advantage that a software 

15 element is fed into the control unit via an already-existing interface, preferably a 

diagnostic interface, of the control unit; and the software element then configures all 
the firing circuits and the triggering algorithm for firing all the firing circuits and, for a 
safety module that checks the sensor values independently of a processor in the 
control unit and then, as applicable, enables the firing circuits as a function of the 

20 check, emulates those sensor values so that the safety module enables all those 
firing circuits. A triggering instance for all firing circuits is thus simulated. By way of 
this software element, all the firing elements can then easily be fired without 
additional connectors by way of the hardware already present, so that disposal firing 
is thus guaranteed in very simple fashion. Emulation of the sensor values is 

25 necessary because the safety pathway cannot be accessed via the diagnostic 
interface. The software element can also be implemented so that it is merely an 
instruction that causes activation in the control unit of further software that 
configures the triggering algorithm and the firing circuits for firing all the firing 
elements that are present, and emulates the sensor values in order ultimately to fire 

30 all the firing elements. 
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Th e f e atures and d e v e lopm e nts d e scr i b e d i n tho dependent c l a i ms mak e poss i bl e 
advantag e ous i mprov e m e nts to th e contro l un i t for a restra i nt syst e m doscr i bod i n 
th e i ndepend e nt c l a i m. 

5 For reasons of uniformity, it is particularly advantageous that the diagnostic interface 
is either a CAN bus or a K-line. The K-line (communications line) is a standardized 
hardware interface by way of which, for example, factory or other diagnoses (shop 
diagnoses) can be made. Advantageously, the processor, the safety module, and at 
least one sensor module and/or at least one interface module for the connection of 

10 external sensors are connected via a bus, the processor emulating the sensor 

values on the bus so that the safety module checks those emulated sensor values. 
The so-called serial peripheral interface bus (SPI bus) is advantageously used as 
the bus. The SPI line itself encompasses five individual lines. Since a synchronous 
transfer is involved, a Clock line (designated CLK) is present. The Master Out Slave 

15 In (MOSI) line is present for data transfer from the master (in this case the 

processor) to a slave (e.g. a sensor IC or an interface module). The Master In Slave 
Out (MISO) line, on the other hand, is present for data transfer from a slave to the 
master. The Chip Select (CS) line is used to select the corresponding slave. An 
Enable line (designated EN) is used to enable SPI data transfer. The SPI line 

20 proceeds from a master and then branches out to the individual slaves, although the 
SPI line always has the five individual lines. Provision is made in this context for the 
processor to transfer those emulated sensor values via the MISO line, through which 
the processor normally receives data, in order thereby to simulate the emulated 
sensor values to the safety module. For that purpose, the MISO line is connected to 

25 an input/output port of the processor for transfer of the emulated sensor values. 

A boot loader, which loads the software element and then immediately starts it, is 
furthermore advantageously provided in the processor. A reset switch, which is 
provided for restarting the at least one sensor module and safety module, can 
30 advantageously also be provided. The firing circuits can also be restarted therewith. 

Brief Description Of The Drawings 

Ex e mplary e mbodim e nts of the i nv e nt i on ar e depict e d in th e draw i ngs and w il l be 
e xp l a i n e d in mor e d e ta il i n th e d e scr i ption b el ow. 
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Figure 1 is a block diagram of the control unit according to the present inventionra«4 
Figure 2 is a flow cha rt according to the present invention . 

5 

Detailed Description 

A disposal firing concept by way of customer diagnostic interfaces already present in 
the airbag control unit, such as CAN or K-line, with no additional interfaces, is 
propos e d provided . Existing mechanical and electrical hardware is utilized. What is 
10 provided in particular in the context of the control unit according to the present 
invention is that an independent safety pathway that is implemented by way of a 
safety module is deceived, by the emulation of such sensor values which indicate a 
triggering instance for all firing elements. 

15 The processor, which can be a microcontroller, evaluates sensor channels such as 
acceleration values and rotation rate values that are available in particular via an SPI 
bus, and processes them in accordance with the implemented algorithms. These are 
the algorithms which serve to activate the restraint means that are fired via the firing 
elements, if they are pyrotechnically triggerable restraint means such as airbags or 

20 belt tensioners. The microcontroller accesses output stage ICs, i.e. the firing circuits, 
via a second (in some circumstances) SPI bus. The output stage ICs monitor the 
firing element and ensure, in the event of triggering, that triggering energy is 
conveyed to the connected firing elements. 

25 A further IC, referred to here as the safety module, is used to implement the 

hardware pathway that is independent of the microcontroller. This safety module is 
connected to the same SPI bus as the sensors and the microcontroller. The safety 
module can be configured only once after each activation of the control unit, after 
which no further write access to it can occur. The safety module monitors the sensor 

30 data transferred over the SPI bus and compares them with the stored limit values. If 
a sensor exceeds defined thresholds, this safety module then, independently of the 
microcontroller, delivers a plausibility signal for the triggering of specific ignition 
circuits. The safety module is thus made up of circuits that, in terms of their 
complexity, are much simpler than those of a microcontroller. 
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According to the present invention a special disposal firing software program, here 
described as a software element, is loaded into the microcontroller via a diagnostic 
interface directly into a RAM memory, and stacked there. A so-called boot loader 
5 software program is used for this. 

The purpose of the disposal firing software program is to operate the control unit 
using all the signals that make possible uninterrupted operation of the control unit. 
This includes operating the watchdog and allowing bus communication. A further 
10 purpose is to manipulate, i.e. configure, the airbag algorithm in the microcontroller so 
that the microcontroller enables triggering of all the firing circuits, and fires them. An 
additional purpose is to cause the safety module to supply plausibility for the output 
stage ICs. 

15 A further constituent of such a concept can optionally be a simple circuit, controlled 
by the microcontroller, for resetting the sensor and output-stage ICs as well as the 
safety module. The boot loader software program controls the reset switch. This 
circuit makes handling of the disposal firing concept more flexible, since after a reset 
of this kind, reconfiguration is possible. This can occur independently of the 

20 initialization phase of the control unit, at the end of which all the ICs are locked and 
write access is thereafter impossible. The software element will then emulate a 
virtual sensor that, via the SPI bus to which the physical sensors and the safety 
module are connected, feeds emulated sensor data onto the SPI bus. Those 
emulated sensor data are evaluated by the safety module and cause the safety 

25 module to enable the output stage ICs. 

Figure 1 shows control unit 100 according to the present invention in a block 
diagram. A processor 101, here embodied as a microcontroller, receives, via a 
transceiver (i.e. an interface module 102) and a diagnostic interface 103, the 
30 software element with which disposal firing is performed. Diagnostic interface 103 is 
in this case a CAN bus or a K-line, or other diagnostic interfaces suitable for the 
purpose. 
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In microcontroller 101, the software element is loaded with a boot loader software 
program 115 out of a RAM serving as memory, and started, so that the software 
element configures the algorithm for activating output stages in processor 101 as 
well as the output stages themselves, and performs the sensor emulation. The 
5 configuration is such that all the firing elements are activated. The algorithm will 
accordingly fire all the firing elements. It is possible to start the software element 
using other programs. 

Processor 101 is connected via a first SPI bus 104 to a safety module 105 and two 

1 0 sensor modules 111 and 112, and to an interface module 1 1 3 to which external 

sensors are connected. Via a second SPI bus 109, microcontroller 101 is connected 
to a memory 119 that is embodied as an EEPROM, to a first output stage IC 108, 
and to a second output stage IC 107. Processor 101 is optionally connected, via a 
data output, to a power switch 110 with which energy reserve voltage is switched 

15 through to output stages 107 and 108. It is additionally possible for processor 101 to 
perform a so-called ASIC reset 117, in which output stages 107, 108 and sensor 
modules 111 and 112 are caused to restart. SPI bus 104 is connected via its MISO 
line to an input/output port on processor 101 , in order to transfer via this actual input 
line, by way of processor 101 , the emulated sensor values of virtual sensor 116 that 

20 is constituted by the software element. The input line is thus used as an output line. 
Safety module 105 is then therefore deceived by means of the emulated sensor 
values in such a way that it enables output stages 107 and 108 via line 106. 
Microcontroller 101 will then cause firing of the firing elements via output stages 107 
and 108, since the triggering algorithm on microcontroller 101 has been configured 

25 by the software element in such a way that triggering can now occur. Safety module 
105 also checks and emulates the sensor values of the sensors externally 
connected via interface module 113. The RAM is associated with processor 101. 

Figure 2 illustrates what happens in control unit 100. In method step 200, the 
30 software element is loaded into processor 101 via interface 103 and transceiver 102, 
and then stacked by boot loader software program 115. This then occurs in method 
step 201. In method step 202 the software element, once constituted (started), will 
then configure the algorithm in processor 101, and output stages 107 and 108, in 
such a way that firing of all the firing elements can occur. This is possible, however, 
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only if safety module 105 also enables output stages 107 and 108. For that purpose, 
sensor values that authorize a triggering of all the firing elements are then simulated 
on bus 104 by the software element via a virtual sensor 116. Safety module 105 
then enables output stages 107 and 108 via line 106. Firing of the firing elements by 
5 output stages 107 and 108 can then take place in method step 204. Output stage 
ICs 107 and 108, as well as sensor modules 111 and 112 containing XY sensors, 
can be restarted for configuration by way of circuit 1 17 that is associated with 
processor 101 , in order to simplify the configuration of these modules for triggering. 
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Abstract Of The Disclosure 

A control unit for a restraint system i s propos e d, which un i t fires all connected 
pyrotechnic firing elements. The control unit receives for that purpose, via an 
interface (103) , a software element that configures all the firing circuits (107, 108) 
and the triggering algorithm for firing all the firing circuits (107, 108) , and that 
emulates for a safety module sensor values such that the safety module (105) 
enables all the firing circuits (107, 108) . 

(Figure 1 
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